Restoring data from healthy PS3 HDD help?

[BrDes]

Hi, everyone!

It is quite a long story, but that's not the situation where I may shorten it. So, here goes...

I had a 60GB PS3 for five years (no cfw) and then decided to let it retire in peace and got a new 160 GB Slim version. Transferring save data took QUITE a while, but was done successfully. But then I noticed that new PS3 way way slower, it took a lot of time to load anything, and rebuilding the database didn't help at all. So what I did was to try and backup all my data via PC means, since I swear I always thought the PS3 internal drive was running under FAT32. First deadly mistake... I connected it to my PC, started it and initialized the drive. Second deadly mistake... After realizing what I've done I immediately connected the HDD back to PS3, tried to run it, but of course it didn't boot at all and asked me to reinstall the firmware. Safe boot "Recover file system" and "rebuild database" options couldn't be started either.

So the first thing I did was to backup the whole drive (sector cloning) using DMDE tool. The idea was to format the drive, find the MBR using HEX Editor (DMDE), copy it to my cloned image, put it all back to the HDD and... profit. I read some threads on the internet with people successfully doing it in 2010, restoring all their data. From what I managed to find, the MBR is located in 00000000-00F03000, so knowing this got my hopes up. But since the safe boot "Format drive" option could not be started for unknown reason, I decided it wouldn't hurt if the drive was formatted when updating the firmware. Third and the last deadly mistake...

I did all as planned, but the MBR back to the original drive image, tried to boot it and got the message "The system cannot be run. The file system is corrupted. Recover?", Why, of course recover! But right the next second after starting the recovery process I got "The file system cannot be recovered. Format the drive?". This is when I started to get a headache that has lasted for 5 days already...

To summarize all I managed to find out about about my case:

1. Windows initialization only rewrites the first sector (512 bytes, 0000-0200).
2. Bytes 00C0-00F0 and 0150-0180 differ for each full format/firmware update. These are the only bytes that are different in whole 15.7MB of MBR record.
3. My guess is those bytes contain the encryption key PS3 uses to recognize the drive.
4. I, of course, lost my original strings when initializing the drive.
5. Somehow if I create a clean firmware reinstall with formatting the drive, then replace the MBR for that drive with MRB taken another clean reinstallation (thus having different 00C0-00F0 and 0150-0180 strings), the PS3 asks for another firmware reinstallation without formatting the drive and then manages to boot. But the same trick doesn't work if I try to make it boot the full image I want to restore. Special street magic?
6. I realize it was stupid to do those three stupid mistakes in the first place, so I'm not really here to read any non-productive posts like "you're screwed", "why would you even think of doing it?", etc. I know I'm screwed, but would still like to hear an opinion of people smarter than me.

If you have any ideas that may help me restore my data, please share them.

[jackkiej]

maybe you can try to do a format on your computer and then use a data rescue program to recover your save data (and other things)
getdataback is a very nice program

[BrDes]

I thought about it. But then again, what am I to do with the decrypted data on my PC with no way to put it back to PS3? Or is there a way to insert that data to PS3?

Plus, data recovery programs usually work with more common file formats like NTFS of FAT. AFAIK, PS3 internal HDD uses some kind of Sony customized UDF format that can hardly be recoverable by those programs.

Okay, so I got an idea how I can try and restore the data. I've created two binary files that contain two instances of formatting with fw update. Both were done on the same PS3 and HDD. So my idea is to compare data on them with a HEX editor. If I'm correct, bytes that differ between them must be the encryption keys the PS3 uses to recognize the drive as its own. So what I need to do is:

1. Compare the data between both images.
2. Insert the bytes that differ into the third image, the one that contains my original profile with all my save data.
3. Write the resulted image on the HDD and try to boot the PS3 with it.
4. ...
5. Profit?

The only gap in my plan is that I found a lot of HEX editors that can compare the data between the two drives, but none of them is able to actually insert that data on the third drive automatically. I tried doing it manually, but there are about a thousand strings of 32 bytes. I gave up somewhere around 50... Does anybody know what tools I can use to complete the task?

[oVERSoLDiER]

What about deleting the partitions from you new HDD under Windows, plug it in the new PS3, let do it the AES-CBC 256-bit key magic and transferring the old data from your phat PS3 to the new and see if it works ?

I could tell you even more about the encryption and signing process which the PS3 does, but this would really help you and I would only put it on if requested.

[BrDes]

oVERSoLDiER, I'm sorry, but I didn't quite understand what you meant. How can I transfer my old data if I can't make my PS3 access the drive? It refuses to read it and suggests to format the drive no matter what I do.

Still, I would really love to hear about the encryption process, if that won't take too much of your time.

[oVERSoLDiER]

Oh, I thought that you just transferred the old stuff on your new PS3 and want to let it die in peace. Well I never put my PS3 HDD on PC, because I know it will not work and / or damage the FS.

I don't have much time right away, but I will put you some facts of the PS3 HDD FS and signing process here and may add additional information later.

• PS3 uses SATA (SATA-150)
• 5400RPM HDDs
• Internal PS3 HDD is encrypted (256-bit AES-CBC encryption)
• GameOS formats it to the proprietary Cell File System (CFS) which is UFS2 (with Sony's added encryption layer)
• Maximum size of the internal harddrive that the PS3 supports is 1TB
• PS3 supports external harddrives (via the USB port) using the FAT32 file system format - max. 8 TB (theoretical drive size limit of FAT32)

The UDF FS you're talking about hasn't anything to do with the HDD. It's the FS of the Blu-ray drive which uses the UDF V2.5 (called DISCFS) and using AACS encryption (128-bit AES).

[BrDes]

oVERSoLDiER, yeah, I knew most of the things you mentioned, but still good to refresh them in my mind, thanks.

And okay, as much as don't want to admit it, now I really feel stupid All the data I've been trying to recover the whole week for countless hours was actually safely stored on my old fat PS3 system. I could swear I saw an official note somewhere that your data gets deleted from the old PS3 during transfer, so the thought of actually checking it hasn't crossed my mind even once until you reminded me about it! Talk about choosing an easier way, huh? Right now I'm using "Data Transfer Utility" to copy all saves to my new PS3... again. Seriously, I've never felt this dumb before. >_<

Of course I still lose some saves that I managed to gather during a couple of weeks playing on my new PS3, but hey, two weeks are not even close to five years, right?

Anyway, thanks for the help! No idea how much more time I'd have wasted trying to recover my data by playing with byte strings. Still, this week was very educational for me, the experience may come in handy one of those days.

Also, I hope this thread and my suggestions may somehow help other people if they find themselves in a similar situation. Just remember, if you created a backup image of your drive, DON'T reinstall the PS3 firmware when formatting the drive if you plan to insert the corrupted MBR to the image. It won't work. If your system refuses to format the drive without reinstalling the firmware, take the HDD out again, do a low level format using your PC tools (fill it with zeroes as if it was newly bought), insert it to PS3 again and format using safe boot tools. That way the encryption key will not change, thus allowing you to take the MBR (bytes 00000000-00F03000 on the drive) and put it to the original image that contains all your precious data, making it bootable again.

P.S. All of the above is IMHO created during my own observations. I may be wrong at some things since I'm not a file system recovery/encryption expert, just a humble IT Support Analyst.

[jackkiej]

Plus, data recovery programs usually work with more common file formats like NTFS of FAT. AFAIK, PS3 internal HDD uses some kind of Sony customized UDF format that can hardly be recoverable by those programs.

you will need to format it first to NTFS ....

[BrDes]

Um... doing that doesn't really help you to recover anything. Even if we don't take the encryption into consideration, formatting a drive with data into another file system doesn't convert your data to the new file system. Like, if you have a FAT32 disk and do a quick format to NTFS, your data will be unreadable, but still recognized and recoverable as FAT32 if you run special tools on it.

It is because the storage principals differ for each file format. So when you copy data under Windows from NTFS drive to a FAT32 stick, the operating system (which can recognize and work with both file systems) also converts the data in the process of copying it. The end user doesn't need to know such differences in order for it to work, so you may call it user friendly.

The other situation is when you are trying to transfer data under Windows OS between NTFS and ext 2 (one of Linux FS), Windows most likely won't even be able to understand the ext2 drive (same thing we're seeing with PS3 drives, plus they are encrypted). More info can be found on Wikipedia if you're ever interested.

[jackkiej]

what i meant in the first reply of me in this thread was that he first format and then use a data recovery program, but i understand what you're saying